Skip to content
skillsafebeta
← Report library
Purpose / Other

Json Canvas Skill Security Audit

What the author says it does (original text)

Create and edit JSON Canvas files (.canvas) with nodes, edges, groups, and connections. Use when working with .canvas files, creating visual canvases, mind maps, flowcharts, or when the user mentions Canvas files in Obsidian.

Independent security check

No obvious risks found in this check

Files checked
2
Risks found
0
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This is a documentation-only workflow for creating, reading, modifying, and validating JSON Canvas files; the provided source contains no scripts, installation steps, or command-execution instructions.

View source
SKILL.md:24In the instructionsOpen original file
### 1. Create a New Canvas1. Create a `.canvas` file with the base structure `{"nodes": [], "edges": []}`2. Generate unique 16-character hex IDs for each node (e.g., `"6f0ad84f44ce9c17"`)3. Add nodes with required fields: `id`, `type`, `x`, `y`, `width`, `height`4. Add edges referencing valid node IDs via `fromNode` and `toNode`5. **Validate**: Parse the JSON to confirm it is valid. Verify all `fromNode`/`toNode` values exist in the nodes array
SKILL.md:51In the instructionsOpen original file
### 4. Edit an Existing Canvas1. Read and parse the `.canvas` file as JSON2. Locate the target node or edge by `id`3. Modify the desired attributes (text, position, color, etc.)4. Write the updated JSON back to the file5. **Validate**: Re-check all ID uniqueness and edge reference integrity after editing

File nodes can store file paths in a canvas, and link nodes can store external URLs. The source only describes these fields and static examples; it does not instruct the agent to read file contents, visit URLs, or transmit data.

View source
SKILL.md:95In the instructionsOpen original file
### File Nodes| Attribute | Required | Type | Description ||-----------|----------|------|-------------|| `file` | Yes | string | Path to file within the system || `subpath` | No | string | Link to heading or block (starts with `#`) |
SKILL.md:114In the instructionsOpen original file
### Link Nodes| Attribute | Required | Type | Description ||-----------|----------|------|-------------|| `url` | Yes | string | External URL |

When modifying an existing canvas, the instructions require avoiding ID collisions and checking duplicate IDs, dangling edge references, and JSON validity afterward, reducing the chance of producing an invalid or structurally damaged file.

View source
SKILL.md:32In the instructionsOpen original file
### 2. Add a Node to an Existing Canvas1. Read and parse the existing `.canvas` file2. Generate a unique ID that does not collide with existing node or edge IDs3. Choose position (`x`, `y`) that avoids overlapping existing nodes (leave 50-100px spacing)4. Append the new node object to the `nodes` array5. Optionally add edges connecting the new node to existing nodes6. **Validate**: Confirm all IDs are unique and all edge references resolve to existing nodes
SKILL.md:224In the instructionsOpen original file
After creating or editing a canvas file, verify:1. All `id` values are unique across both nodes and edges2. Every `fromNode` and `toNode` references an existing node ID3. Required fields are present for each node type (`text` for text nodes, `file` for file nodes, `url` for link nodes)4. `type` is one of: `text`, `file`, `link`, `group`5. `fromSide`/`toSide` values are one of: `top`, `right`, `bottom`, `left`6. `fromEnd`/`toEnd` values are one of: `none`, `arrow`7. Color presets are `"1"` through `"6"` or valid hex (e.g., `"#FF0000"`)8. JSON is valid and parseableIf validation fails, check for duplicate IDs, dangling edge references, or malformed JSON strings (especially unescaped newlines in text content).
Start here · InstructionsSKILL.md
json-canvas
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/EXAMPLES.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/EXAMPLES.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:10In the instructionsOpen original file
A canvas file (`.canvas`) contains two top-level arrays following the [JSON Canvas Spec 1.0](https://jsoncanvas.org/spec/1.0/):
SKILL.md:128In the instructionsOpen original file
  "height": 200,  "url": "https://obsidian.md"}
SKILL.md:243In the instructionsOpen original file
- [JSON Canvas Spec 1.0](https://jsoncanvas.org/spec/1.0/)- [JSON Canvas GitHub](https://github.com/obsidianmd/jsoncanvas)
Lines read
575
File checksum (to compare versions)
bc84ebd7975bea0aa8caca512fbde72edcbec4731d9f6559bb084c2561553ee5